Analysis
- max time kernel
108s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
10/03/2023, 12:23
General
- Target e74d706b67705285a54359b008364d8c.exe
- Size 4.5MB
- Sample230310-pkgvfade94
- SHA256 189324e467efc3aa877a7f8a825aadc7ea5f1698abbe3e15eb686e5d8e2dff49
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e74d706b67705285a54359b008364d8c.exe"C:\Users\Admin\AppData\Local\Temp\e74d706b67705285a54359b008364d8c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\regid.1991-06.com.microsoftSoftwareDistribution-Type3.0.8.1\regid.1991-06.com.microsoftSoftwareDistribution-Type3.0.8.1.exe"C:\ProgramData\regid.1991-06.com.microsoftSoftwareDistribution-Type3.0.8.1\regid.1991-06.com.microsoftSoftwareDistribution-Type3.0.8.1.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
regid.1991-06.com.microsoftSoftwareDistribution-Type3.0.8.1.exe
regid.1991-06.com.microsoftSoftwareDistribution-Type3.0.8.1.exe
regid.1991-06.com.microsoftSoftwareDistribution-Type3.0.8.1.exe
memory/3204-134-0x0000000000700000-0x0000000000B62000-memory.dmp
memory/3204-139-0x0000000005670000-0x0000000005C14000-memory.dmp
memory/3204-140-0x0000000005160000-0x00000000051F2000-memory.dmp
memory/3204-141-0x0000000005140000-0x000000000514A000-memory.dmp
memory/3204-142-0x0000000005310000-0x0000000005320000-memory.dmp
memory/3204-143-0x0000000005310000-0x0000000005320000-memory.dmp
memory/3204-144-0x0000000005310000-0x0000000005320000-memory.dmp
memory/3204-145-0x0000000005310000-0x0000000005320000-memory.dmp